author | Lars Hjemli <hjemli@gmail.com> | 2009-01-29 21:21:15 (UTC) |
---|---|---|
committer | Lars Hjemli <hjemli@gmail.com> | 2009-01-29 21:21:15 (UTC) |
commit | 7efcef00b5aadf22f5be80ecd7b736398cf7f6b4 (patch) (unidiff) | |
tree | 6bfdb7c5499ba43eb9b302394adc7bfa7e517436 | |
parent | ba75f6613ebce2d716334d912932f1bd78ef124f (diff) | |
download | cgit-7efcef00b5aadf22f5be80ecd7b736398cf7f6b4.zip cgit-7efcef00b5aadf22f5be80ecd7b736398cf7f6b4.tar.gz cgit-7efcef00b5aadf22f5be80ecd7b736398cf7f6b4.tar.bz2 |
html.c: use correct escaping in html attributes
First, an apostrophe is not a quote. Second, we also need to escape
quotes. And finally, quotes are encoded as '"', not '"e;'.
Sighned-off-by: Lars Hjemli <hjemli@gmail.com>
-rw-r--r-- | html.c | 6 |
1 files changed, 4 insertions, 2 deletions
@@ -103,32 +103,34 @@ void html_ntxt(int len, char *txt) | |||
103 | } | 103 | } |
104 | if (t!=txt) | 104 | if (t!=txt) |
105 | write(htmlfd, txt, t - txt); | 105 | write(htmlfd, txt, t - txt); |
106 | if (len<0) | 106 | if (len<0) |
107 | html("..."); | 107 | html("..."); |
108 | } | 108 | } |
109 | 109 | ||
110 | void html_attr(char *txt) | 110 | void html_attr(char *txt) |
111 | { | 111 | { |
112 | char *t = txt; | 112 | char *t = txt; |
113 | while(t && *t){ | 113 | while(t && *t){ |
114 | int c = *t; | 114 | int c = *t; |
115 | if (c=='<' || c=='>' || c=='\'') { | 115 | if (c=='<' || c=='>' || c=='\'' || c=='\"') { |
116 | write(htmlfd, txt, t - txt); | 116 | write(htmlfd, txt, t - txt); |
117 | if (c=='>') | 117 | if (c=='>') |
118 | html(">"); | 118 | html(">"); |
119 | else if (c=='<') | 119 | else if (c=='<') |
120 | html("<"); | 120 | html("<"); |
121 | else if (c=='\'') | 121 | else if (c=='\'') |
122 | html(""e;"); | 122 | html("'"); |
123 | else if (c=='"') | ||
124 | html("""); | ||
123 | txt = t+1; | 125 | txt = t+1; |
124 | } | 126 | } |
125 | t++; | 127 | t++; |
126 | } | 128 | } |
127 | if (t!=txt) | 129 | if (t!=txt) |
128 | html(txt); | 130 | html(txt); |
129 | } | 131 | } |
130 | 132 | ||
131 | void html_url_path(char *txt) | 133 | void html_url_path(char *txt) |
132 | { | 134 | { |
133 | char *t = txt; | 135 | char *t = txt; |
134 | while(t && *t){ | 136 | while(t && *t){ |